Next-Generation Cybertrap for Enterprise Intrusion Detection Systems

This project dissertation focuses on the development and implementation of a next-generation cybertrap system for corporate intrusion detection and prevention in enterprise environments. The project explores various aspects of network security, including intrusion detection systems (IDS) and intrusion prevention systems (IPS). It delves into the architecture and functionality of a cybertrap, examining its different modules such as malware detectors, intrusion detectors, honeypot managers, auditors, and backup managers. The dissertation discusses the challenges faced by intrusion detection servers, including effective deployment, managing alert volumes, understanding alerts, and responding to threats. Furthermore, it covers the role of firewalls and explores mitigation methodologies to protect corporate data against cyber threats. The project aims to provide a comprehensive understanding of how these systems work and the methodologies used to secure corporate networks.

Project Dissertation
Title:Next-GenerationCybertrap For Corporate Intrusion Detection Servers and
Intrusion Prevention Servers in Enterprise Business.

TABLE OF CONTENTS
INTRODUCTION...........................................................................................................................4
Aim and Objectives....................................................................................................................11
Background and motivation.......................................................................................................12
Problem......................................................................................................................................12
Proposed solution.......................................................................................................................12
Structure of thesis.......................................................................................................................12
Summary....................................................................................................................................13
LITERATURE REVIEW..............................................................................................................14
TECHNOLOGY............................................................................................................................21
APPROACH..................................................................................................................................33
DESIGN.........................................................................................................................................42
IMPLEMENTATION....................................................................................................................47
CONCLUSION..............................................................................................................................56
REFERENCES..............................................................................................................................57

ABSTRACT
Next Generation Intrusion Prevention Systems is also term as Intrusion Detection & Prevention
Systems (IDPS). Here we can see that Next Generation Cyber trap for corporate intrusion
detections server and intrusion prevention servers in Enterprise business that consists of different
network security applications which monitor the network and suspicious activities in the system.
This system will protect the corporate from the default attacks to the new attack and also controls
the system and prevent the system by the cyber threat. The expertise of Next-generation intrusion
prevention system helps to protect the sensitive data and the information also the application
from the cyber threat and manage the performance of the system. Our project is mainly focused
on explaining the different mitigation methodologies or techniques used by corporate for storing
information and data that is going to be used in the network system. Further, in our paper, we are
going to discuss more these things. In this type of mitigation plan, the attackers are not able to
penetrate inside the system and outside the system to secure fully. After implementing this
system in the corporate we will be able to find the types of attacks and methods used by the
attackers so that we can easily install that technology in our system to protect information and
data against different types of cyber threats.

CHAPTER 1
INTRODUCTION
INTRODUCTION
Cyber Trap becomes the trendsetting word in the growing generations’ minds who work
upon a lot on the internet. This word will be more familiar for the corporate companies as they
come through such problems day-to-day basis. They make their process on the internet which
will make their work so easier and instant. Believing in this, these crew people collect data
from the internet but they were not aware of the problems which will affect them later. Due to
this access of internet, the hidden side of the internet gets wild and gains a lot of profit, but
locating and targeting the small corporate companies because they don’t maintain high security
on the internet. But they do believe that they have strong security connections that no one could
enter the area and access the data. Their intention is completely wrong because Cyber trap is a
huge background trap that takes out the data from their site with ease of effort. They are
otherwise called as attackers of corporates who enjoy a lot in trapping and getting out the data
at the most level (Akhil Gupta, et al., 2018) (Navneet Kambow et al., 2014).
According to a recent survey, it is obvious that 96% of the business people are fooled by
the Cyber Trap method. To know about the happenings, the company brought out an idea to
detect the attack made by the internet user. Then there was an emergence of a processor called
honeypots to detect the malware capture, which is placed in a corner of a network to capture the
attackers. The proposed system is capable of detecting the network attacks on significant
resources and to capture the malware being spread in the network. This system consists of
various modules to monitor the system after knowing and understanding the basics from the
human interaction. During the initial process of the detectors, they learn about the signature and

the behaviour of the malware. Later they were fed with the modern executables and binaries
system which them capable to find out the malware which harms the computing network. This
package checks for the malicious match to find out the harm material (Chaitali Choure, et al.,
2018).
Then cyber trap came into charge, the Intrusion Detection module which acts more effective
which watches out for the intrusion chances. When an attack is made, it comes into act making
an attentive alarm which intends in creating a honeypot to which will be the replica of the
victim resource. All the services which were running on the victim machine will be faked into
the honeypot, in case of this, the attacker will redirect. But the IDS are very conscious clear that
the redirected work should not be found out by the attacker. This additional feature of this
makes a good hype in this intrusion module detector. This even too provides a system called
sandbox, which will not harm the operation of the original resources and maintain the records
in a safe manner. There comes along an automated honeypot management system which
manages such critical circumstances. Every particular process will have a design feature which
goes from initial to final stages. This design has made with five different modules namely
Malware detector, an Intrusion detector, Honeypot Manager, Auditor and Backup manager
(Chau Tran, et al., 2017).
To know about the attackers, the inventors had different methods of a plan to make the
attackers attract towards their honeypots. To make this happen they made their trap by making
the server most requested one and high ranking one which will lure more attackers. By that
time, the initial stage which is the Malware detector checks for the incoming threats whereas
the other modules will not get into charge unless they are needed. The honeypot manager
created the honeypots for the attackers to be detected to the server, then the Auditor checks the

system for any malicious activity and in the generated logs after particular events next comes
the Backup manager who will in charge to backup the resources and honeypots whenever
necessary (Chau Tran, et al., 2017).
Malware Detector
The malware detector works with collaboration and runs independently on the internet
to detect and capture any malware in the network. This module consists of various functions,
search for malware in different ways, and later submits the result to the server for further
research. This module has 3 types naming fetcher, watcher and hunter. A fetcher is a service
which does cross-matching to catch any malicious files. Watcher watches the network for any
harm file to capture. Hunter is a pre-processor which extracts Windows binaries which come
into the network and checks them for the unwanted harm files (David Ahmad Effendy, et al.,
2017).
Intrusion detector
Intrusion detector is similar when compared with the Hunter detector which is a pre-
processor which controls the calling of other modules. Whenever there is an intrusion, the
intrusion detector detects and shoots out an alert and calls other modules if necessary alone.
The intrusion detector module has a function for log parsing, which keeps its eyes on the log
for intrusion attempts. Even in this case, if a harm is detected an alarm is provided to the
administrator. The module looks for the harm, if any harm is detected, it connects with the
honeypot module to create a honeypot and deal further with the attacker (David Ahmad
Effendy, et al., 2017).

Honeypot Manager
This is one of the important modules is the honeypot manager, which creates a honeypot
to locate the threats. The main function of this is to create a honeypot to take out the threats by
fetching information from the intrusion detector. This module provides a sandbox feature so
that the attacker can play inside the honeypot without interrupting the original resources (Elike
Hodo, et al., 2017).
Auditor
The auditor module functions to collect all the data connecting to the network to check
for the intrusion or network changes. It checks for all changes which should be sent to the
Honeypot manager so that it can able to create an absolute replica of the damaged data
(Ennahbaoui, M. Idrissi, H, 2018).
Backup Manager
The function of the Backup manager is so relevant to the name of the heading that it
should keep a backup of resources and the honeypots. This module takes regular backups and
always will be ready to provide the replica of resources and honeypots, to provide restoration in
case of any sudden events. It would also be capable of creating a Honeypot which was
previously attacked by the attacker. When instead of getting a clean honeypot, if an attacker
gets a resource with plenty amount, he might tend to leave some traces as the attacker will be
keen on taking out the data and the attacker will not be recognising that they are playing with
honeypot which would easily find out the attacker. The Honeypot manager too contains the
backup of the resource (Elike Hodo, et al., 2017).

1.2 INTRUSION PREVENTION SERVER
Intrusion prevention is as similar to intrusion detector in which it is detected and taken
out, but the advanced level of it is the intrusion prevention which prevents the attackers enter
into the network which is much required every corporate company who maintain their most
valuable and important data in the network. An exploit may carry out an instant after the
attackers gain access whereas the intrusion prevention detector has the ability to take quick
action on it based on some kind of rules framed by the administrator. An effective intrusion
detector should perform very complex monitoring and analysis such as watching to the activity
and responding to the administrator patterns and individual patterns. To be factual, an Intrusion
Prevention System should use any product or method that is used to keep away the attackers
from compromising the networking using some concepts like firewalls and anti-virus software
(Fang-YieLeu, et al., 2015).
1.3 FIREWALL
Firewall is an internet security which controls the incoming signals and outgoing signals
in the networking server. Network firewalls filter the traffic between the signals and run on
computer hardware. Mostly, a firewall is always installed away from the remaining network so
that no other illegal signals enter into the private sector of the company.
The firewall has three layers which protect the data to be attacked.
1. Packet filters firewall
2. Stateful filters firewall
3. Application layer firewall

1.4 CHALLENGES OF INTRUSIVE DETECTION SERVER
Network and intrusion detection systems play a wide role in securing the data by
preventing the data entry into the servers of corporates. To know the capacity of the
technology, the organizations must face a number of challenges (Gisung Kim, et al., 2014).
The challenges are,
Ensuring an effective deployment
While receiving such threats from the attackers, the organisations must make sure that
the security is in a high level that is an effective deployment. In the world, many companies
were not aware of their entire view of the network so deploying Intrusive Detection server can
be so difficult.So the organization has to make sure that they ensure a good deployment
(Gisung Kim, et al., 2014).
1.4.1 Managing the high volume of alerts
To manage high-level threats, the server is fixed with a great alert signal which indicates
the illegal entry in the network or when the receiving signal does not match the pattern. So that
the alert volume should be hyperactive so that the company can compete for the internet world
with full confidence which too helps them maintain their data in a secure manner (Gisung Kim,
et al., 2014).
1.4.2 Understanding and investigating the alerts
Intrusive Detection Server consists of a very base level security, it looks so normal type of
security when it is placed alone. When updated with an alert, it looks good and effective for
detecting the threats. When the IDS is investigated for its alerts it takes very less time and

fewer resources when compared to the other system which tends to determine the seriousness
of the alarm. Special skills are required for interrupting the system output where the
organization may lack the security in performing such functions (Gisung Kim, et al., 2014).
1.4.3 Knowing how to respond to threats
IDS is very much effective in identifying the appropriate problem which is a great
feedback for the corporate companies but they couldn’t be too confident that they have high
security because Intrusion detection server just locates the problem which is just half the
problem solved. To solve the problem is important whereas responding correctly to the problem
is more important which behaves as the half the process of solving the problem. The lack
happens here in this IDS. Effective incident requires skills in this and have to know about the
robust procedures to solve the problem. To emphasize the importance of having unsuitable
incident response plan, the incoming General Data Protection Regulation(GDPR) requires
organizations that continue any type of data to have perfect controls in a perfect place to report
the security breaches to a related authority within two days or it will lead to a huge amount of
dues (Gisung Kim, et al., 2014).
1.5 ADVANTAGES OF INTRUSION DETECTION SERVER
1.5.1 Constant Network Monitoring
Constant Network monitoring continuously works all 24*7 for the corporates which
make them fear free from the attackers. This feature allows the server to be safe even when the
user is in sleep or awake. It maintains security and detects the attacker and produces an alert
signal to the management (PeymanKabiri and Ali A.Ghorbani, 2005).

1.5.2 Versatility of the system
Intrusive detection server is customizable to accommodate special client needs. The
appointment will be based on the versatile performance of an individual so that he can be
efficient enough to analyse the attacks and produce solutions to it. The system can monitor the
threats from both the inside and outside the network with the help of the system behaviour the
threats can be identified (Gulshan Kumar, et al., 2018).
1.6 DISADVANTAGE OF INTRUSIVE DETECTION SERVER
1.6.1 Telling a threat from a friend
The main disadvantage is that they do not have the ability to tell the information from friend to
foe. Users inside may have a harmless activity which will lead to lockdown to the network. It
will be as same as locked until an undetermined amount of time. The professional has to be
available all time to identify and reset the threat. For a business class people, this can cause a
drastic loss of revenue an client confidence, as any of companies partner may take business
elsewhere to a company with a reliable network (Gulshan Kumar, et al., 2018).
1.7 AIM AND OBJECTIVES
 The main aim of this project is to find out that whether the organizations have
enough security measures to protect or prevent the information and data from
cyber-attacks on the World Wide Web.
 The main objectives for selecting this project are to find out whether the
available security standards and security practices are capable to protect the
organizational data and information from security threats and attacks.

1.8 BACKGROUND AND MOTIVATION
Cyber trap products nowadays installed in the private and public sectors all over the
world. Cyber trap products mainly applied to analyze the big data for monitoring the traffic in
the network and provide visibility on both the end of the network of the organizations. It also
provides a plan for the organization to show how they can secure their data and information.
Also, the cyber trap system is going to provide the information about IP and other suspicious
activities of the user as well as a system administrator. The cyber trap technology is going to
support the different type of technology among currently available technologies in the market
and from another different type of security threat situations.
1.9 PROBLEM
Nowadays, different types of organizations that have daily multiple types of traffic
generations at the applications level and from another different type of security threats use a
cyber trap to protect their network. Different types of security threats are possible so that most
of the largest global organization uses cyber trap methods to manage and secure the
information and identities as well as their technology infrastructure.
1.10 PROPOSED SOLUTION
Cyber trap is the leading solutions that can provide security to loss of data and
information over the system network of the organizations.
1.11 STRUCTURE OF THESIS
The thesis starts with the chapter 1.Introduction of next generation cybertrap for the
corporate. In chapter 2.Literature review about the intrusion prevention and detection are